{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/1130","repository_url":"https://api.github.com/repos/whatwg/html","labels_url":"https://api.github.com/repos/whatwg/html/issues/1130/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/1130/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/1130/events","html_url":"https://github.com/whatwg/html/issues/1130","id":151178265,"number":1130,"title":"Use of source browsing context in navigation seems totally broken to me","user":{"login":"bzbarsky","id":1457979,"avatar_url":"https://avatars2.githubusercontent.com/u/1457979?v=3","gravatar_id":"","url":"https://api.github.com/users/bzbarsky","html_url":"https://github.com/bzbarsky","followers_url":"https://api.github.com/users/bzbarsky/followers","following_url":"https://api.github.com/users/bzbarsky/following{/other_user}","gists_url":"https://api.github.com/users/bzbarsky/gists{/gist_id}","starred_url":"https://api.github.com/users/bzbarsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bzbarsky/subscriptions","organizations_url":"https://api.github.com/users/bzbarsky/orgs","repos_url":"https://api.github.com/users/bzbarsky/repos","events_url":"https://api.github.com/users/bzbarsky/events{/privacy}","received_events_url":"https://api.github.com/users/bzbarsky/received_events","type":"User","site_admin":false},"labels":[{"id":370052564,"url":"https://api.github.com/repos/whatwg/html/labels/topic:%20navigation","name":"topic: navigation","color":"009800","default":false}],"state":"open","locked":false,"assignee":{"login":"annevk","id":1544111,"avatar_url":"https://avatars3.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"assignees":[{"login":"annevk","id":1544111,"avatar_url":"https://avatars3.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false}],"milestone":null,"comments":33,"created_at":"2016-04-26T16:20:23Z","updated_at":"2017-05-02T11:03:32Z","closed_at":null,"body":"The way HTML does navigation is that the input is a \"source browsing context\".  This is then used in phrases like \"the origin of the source browsing context\" (not defined anywhere; browsing contexts don't have origins) and \"Set request's client to the source browsing context's active document's Window object's environment settings object\".\n\nThe problem is that the active document of the source browsing context may not be the document responsible for the navigation, no?  Unless we're very careful to ensure that scripts in no-longer-active documents can't perform window.open (even on other windows!), can't submit forms, can't trigger targeted anchors, etc.  I'm pretty darned sure nothing prevents the window.open thing, at least.\n\nWe should really be passing in the source window or source document or something here.\n"},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/298605509","html_url":"https://github.com/whatwg/html/issues/1130#issuecomment-298605509","issue_url":"https://api.github.com/repos/whatwg/html/issues/1130","id":298605509,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars3.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2017-05-02T11:03:32Z","updated_at":"2017-05-02T11:03:32Z","body":"Notes from discussion on IRC:\r\n\r\n* Gecko grabs \"source origin\", \"referrer\", and a few other things before invoking \"navigate\", so those don't necessarily come from the same source.\r\n* Gecko uses browsing contexts to determine \"allowed to navigate\"; in practice that's only needed for `<a>` and `<form>` (browsing context that contains their node document), and `window.open()` (browsing context that contains its relevant global object). And then the origin that gets compared is that of the current document origin (which I think is the active document in the specification)."}}
{"actor":{"display_login":"annevk"}}